Archive

Well, strange things happened today . While working on a project , I noticed a strange high incoming network traffic on the system monitor of my ubuntu machine. High, as in ~8MBps with small bursts that lasted some minutes and produced ( according to system monitor again ) a total download traffic of 1.9 GB .
As you can imagine I was pretty surprised , I was sure I was not running anything that could cause such amounts of traffic . The applications running at that time were skype, firefox , thunderbird and Aptana studio none of which could result to that kind of traffic (I had only one tab open in ff at the time , pointing to KTH website , and Aptana’s automatic update process needs user confirmation in order to download updates) . My first reaction was to run netstat , which produced uninteresting results , typical ESTABLISHED connections by thunderbird to the imap servers it was supposed to, a connection to ip 174.129.193.12 initiated by an application recognised as “python” ( which was actually the ubuntu one client ) , one regarding skype and one regarding ff as expected more or less. I didn’t keep the output somewhere but I’m pretty sure I didn’t miss anything there. As I was gradually getting from surprised to worried since the traffic seemed to continue at approx the same rate, I fired up wireshark and started capturing my wired interface. Couple of minutes after that the traffic stopped and I haven’t noticed anything peculiar since.

So I started to check the capture , trying to find the stream that produced the traffic I observed. From a first look there seemed to be many long UDP flows from different IP addresses (various high ports) to a specific IP address (not my interface’s though) on port 51508 . The destination address is in the same subnet as mine and I have confirmed that is up and port 51508 (among other high ports is open). This smelled like bittorrent traffic from distance . To confirm , here is what a random packet of that stream looked like :

which is actually a find_node DHT QUERY as described here . While this sort of explains the nature of the traffic , it doesn’t explain

a) Why was I apparently receiving this traffic when I was not supposed to in the first place .

b) If I was receiving the traffic, what was it and where was it stored in my machine.( remember we are talking about ~2GB of data.)

To start with b) I didn’t remember the last time I checked how much space i was using on my disk, but the current usage percentage didn’t seem alerting by itself. So , this is where find(1) came in handy

~$ find . -type f -mmin -120 -printf '%p %s \n'

didn’t reveal anything interesting although. There were a bunch of files modified in the past 2 hours , but none of them seemed suspicious or modified with no reason.

as to a) I can only make wild guesses. One detail that might be interesting is that yesterday all the switches in the building were replaced so to support the 100/1o we are ow offered (hence the 8,4 MBps in the beginning) .It doesn’t look like an ARP attack , according to the capture. But what kind of misconfiguration would have these kind of results ? I can see a lot of packets addressed to other hosts. CAM table overflow at the switch ?But why I was seeing the traffic in the system monitor ? Shouldn’t those packets be dropped by my NIC ? It wasn’t in promiscuous mode before I ran wireshark .